Source code monitoring for a large development group

From: Craig Minton <CraigSecurity(at)blazemail.com>
Date: Tue Nov 26 2002 - 16:29:29 EST

How does on monitor source code in an organization with hundreds of developers? We are trying to focus on writing more secure code, but with hundreds of developers and sometimes contractors, how do you really know that backdoors or easter eggs were not hidden? Code reviews are good, but it still does not give one good assurance that other code is not being slipped in. Also, forcing all developers to use the same version control and requiring that the code be built from that version control should help insure that only the code in version control goes to production. It is at this point where searching the code become necessary, but it is also very laborious. Any ideas would be greatly appreciated.

Thank you.
Craig

---

Fight the power! BlazeMail.com

---

Select your own custom email address for FREE! Get you(at)yourchoice.com w/No Ads, 6MB, POP & more! http://www.everyone.net/selectmail?campaign=tag Received on Wed Nov 27 03:48:10 2002